|
Posted by SANTANDER on June 28, 2008, 7:31 am
If you were Registered and logged in, you could reply and use other advanced thread options
>
> | Win XP home, NOD32 3.0.650.0 antivirus. I got infected with
Win32/Alman.NAB
> | virus. My antivirus show some executable files where infected, aalso
when
> | browse web with Internet Explorer, windows periodically popup error
mesages
> | called RUNDLL:
> | "Error loading C:\Windows\AppPatch\Jview.dll
> | The specified module could not be found."
> | (I use Firefox by default).
>
> | After running whole computer scan, NOD32 isolated the infected files in
a
> | Quarantine folder. I removed the Jview.dll
> | As far I know, Win32/Alman.NAD is infector, downloader and it has got
his
> | own driver. If it sit inside some legit process (IE), then it will add
new
> | registry key again. Then removing will be harder.
> | Then I run HijackThis utility, and got the following report, I looked
> | through the logfile, but I'm not sure which processess and keys are
> | legitimate.
>
> < snip >
>
> | What is strange, there is 4 running svchost.exe processes..
>
>
> First off do NOT post HJT logs to Usenet in general or the Microsoft
hierarchy in
> partcular. If you had bothered to ask, you would have been told this and
you would have
> been provided with a list of trusted expert forums where HJT logs are
allowed and
> encoraged.
>
> Secondly, it is NOT the number of running copies of SVCHOST.EXE that is
important. Having
> 4 ~ 8 running copies of SVCHOST.EXE can be considered normal. What is
important is the
> fully qualified path. SVCHOST.EXE running from %windir%\system32 is
legitimate.
> SVCHOST.EXE running from a location such as; %windir% or C:\Program
Files\Common
> Files\System are illegitimate locations and are most likely malware.
>
>
>
> 1. Download and execute HiJack This! (HJT)
> http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
>
> 2. Disable Notepad's word wrap:
> In Notepad.exe; Format --> uncheck; "Word wrap"
>
> 3. Download/run Deckard's System Scanner:
> http://www.techsupportforum.com/sectools/Deckard/dss.exe
>
> 4. Save the scan results (Main.txt and Extra.txt)
>
> 5. And then post the contents of Main.txt and Extra.txt in your post in
one of the below
> expert forums...
>
>
> { Please - Do NOT post the HJT and Deckard's System Scanner Logs here ! }
>
> Forums where you can get expert advice for HiJack This! (HJT) and
Deckard's System Scanner
> Logs.
>
> NOTE: Registration is REQUIRED in any of the below before posting a log
>
> Suggested primary:
> http://www.thespykiller.co.uk/index.php?board=3.0
>
> Suggested secondary:
> http://www.bleepingcomputer.com/forums/forum22.html
> http://castlecops.com/forum67.html
> http://www.malwarebytes.org/forums/index.php?showforum=7
>
> Suggested tertiary:
> http://www.dslreports.com/forum/cleanup
> http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
> http://www.atribune.org/forums/index.php?showforum=9
>
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
> http://gladiator-antivirus.com/forum/index.php?showforum=170
> http://forum.networktechs.com/forumdisplay.php?f=130
> http://forums.maddoktor2.com/index.php?showforum=17
> http://www.spywarewarrior.com/viewforum.php?f=5
> http://forums.spywareinfo.com/index.php?showforum=18
> http://forums.techguy.org/f54-s.html
> http://forums.tomcoyote.org/index.php?showforum=27
> http://forums.subratam.org/index.php?showforum=7
> http://www.5starsupport.com/ipboard/index.php?showforum=18
> http://aumha.net/viewforum.php?f=30
> http://makephpbb.com/phpbb/viewforum.php?f=2
> http://forums.techguy.org/54-security/
> http://forums.security-central.us/forumdisplay.php?f=13
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>
-----
This forums are absolutely useless, same as most of mentioned tolls like
Deckard's System Scanner, etc, etc. This "tools" just litter registry
settings and are are ineffective and useless.
Windows has "malicious software removal tool" but itts also absolutely
useless thing, and not working at all..
| 
XML site map